v2.4.0: key stored credentials by certificate fingerprint

1 files changed, 19 insertions, 15 deletions

diff --git a/src/bin/client/connection.rs b/src/bin/client/connection.rs
index 44cfea9..ec5642c 100644
--- a/src/bin/client/connection.rs
+++ b/src/bin/client/connection.rs
@@ -56,10 +56,10 @@ pub fn connect(
 
     // TOFU: persist the fingerprint on first contact.
     if !unsafe_mode {
-        if let Some(fp) = observed {
+        if let Some(fp) = observed.as_deref() {
             if database::get_fingerprint(conn, addr).is_none() {
-                database::save_fingerprint(conn, addr, &fp)?;
-                for line in first_contact_lines(addr, &fp) {
+                database::save_fingerprint(conn, addr, fp)?;
+                for line in first_contact_lines(addr, fp) {
                     println!("{}", line);
                 }
             }
@@ -80,21 +80,25 @@ pub fn connect(
         elapsed.as_secs_f64() * 1000.0
     );
 
-    if let Some((username, password)) = database::get_credentials(conn, addr) {
-        let auth_msg = format!("AUTH {} {}", username, password);
-        tls.write_line(&auth_msg)?;
-        let mut auth_response = String::new();
-        tls.read_line(&mut auth_response)?;
-        if auth_response.trim().starts_with("OK") {
-            println!("Authenticated as {}", username);
-            Ok((tls, Some(username)))
-        } else {
+    // Credentials are stored per server identity, so any address presenting
+    // this certificate key can log in with the same stored account.
+    let identity = observed
+        .clone()
+        .or_else(|| database::get_fingerprint(conn, addr));
+    if let Some(identity) = identity {
+        if let Some((username, password)) = database::get_credentials(conn, &identity) {
+            let auth_msg = format!("AUTH {} {}", username, password);
+            tls.write_line(&auth_msg)?;
+            let mut auth_response = String::new();
+            tls.read_line(&mut auth_response)?;
+            if auth_response.trim().starts_with("OK") {
+                println!("Authenticated as {}", username);
+                return Ok((tls, Some(username)));
+            }
             println!("Authentication failed: {}", auth_response.trim());
-            Ok((tls, None))
         }
-    } else {
-        Ok((tls, None))
     }
+    Ok((tls, None))
 }
 
 /// Wrapper so TLS handshake failures surface as errors with their message